SAE 041 ICES-331

Mars Exploration Rover: Thermal Design is a System Engineering Activity

Glenn T. Tsuyuki, Arturo Avila, Henry 1. Awaya, Robert J. Krylo, Keith S. Novak, and Charles J. Phillips

Jet Propulsion Laboratory, California Institute of Technology

Copyright 0 2004 SAE International

ABSTRACT

The Mars Exploration Rovers (MER), were launched in June and July of 2003, respectively, and successfully landed on Mars in early and late January of 2004, respectively. The flight system architecture implemented many successful features of the Mars Pathfinder (MPF) system: A cruise stage that transported an entry vehicle that housed the Lander, which in turn, used airbags to cushion the Rover during the landing event. The initial thermal design approach focused on adopting the MPF design wherever possible, and then concentrating on the totally new Rover thermal design. Despite a fundamentally sound approach, there were several salient lessons learned. Some were due to differences from MPF, while others were caused by other means. These lessons sent a clear message: thermal design continues to be a system engineering activity. In each major flight system assembly, there are excellent examples of this recurring theme. From the cruise stage, the cascading impact of a propulsion fill and drain valve thermal design change after system level test is described. In addition, we present the interesting resolution of the sun sensor head thermal design (bare metal versus white paint). The final implementation went against best thermal engineering practices. For the entry vehicle consisting of the aeroshell and equipment mounted to it, an inertial measurement unit mounted on a shock-isolation fixture presented a particularly difficult design challenge. We initially believed that its operating time would be limited due to its relatively low mass and high power dissipation. We conclude with the evolution of the Rover actuator thermal design where the single- string warm-up heaters were employed. In this instance, fault protection requirements drove the final thermal design implementation, and in the case of Opportunity, proved to be critical for meeting primary mission lifetime.

INTRODUCTION

The primary mission objectives were to determine the aqueous, climatic, and geologic history of a pair of sites on Mars where the conditions may have been favorable to the preservation of evidence of pre-biotic or biotic processes. The primary missions requirements were to deliver two identical rovers to the surface of Mars in order to conduct geologic and atmospheric investigations for at least 90 Sols (approximately 93 Earth days) after landing and to demonstrate a total traverse distance of at least 600 m, with a goal of 1000 m’.

The MER flight system design adapted many successful features of the Mars Pathfinder (MPF) spacecraft design that was launched in 1996 and landed on Mars on July 4, 1997. During cruise, MER was a spin-stabilized spacecraft with a nominal spin rate of 2 revolutions per minute (rpm). The MER flight system consists of four major components: cruise stage, entry, descent, and landing (EDL) system, Lander structure, and the Rover. The mass allocation for the entire flight system (including propellant load) was 1065 kg. The cruise configuration is

Cruise Stage

- 2.65 Itt - In July 2000, with a little less than three years to launch, NASA formally approved a dual rover mission to Mars, known as the Mars Exploration Rover (MER) Project. Figure 1: MER flight system configuration

I"" "'I fj

I I 0

U

U

3

5 0 -

I

x "- B I E i i

r--

QI

CR m Y

shown in Figure 1.

The two Mars Exploration Rover missions were designated as MER-A (Spirit) and MER-B (Opportunity). The first spacecraft (MER-A) was launched on June 10, 2003 atop a Boeing Delta II 7925 launch vehicle from Kennedy Space Center (KSC). The second spacecraft was launched on July 8, 2003 on a Boeing Delta II 7925H. Approximately 7 months after launch, the spacecrafts entered the Martian atmosphere directly from their interplanetary trajectories. Similar to the MPF mission, the MER entry trajectory followed an unguided, ballistic descent. The spacecraft relied on a heatshield and parachute to slow its descent through the Martian atmosphere, fired retro-rockets to reduce its vertical landing velocity, and finally deployed airbags to cushion its impact with the surface. After the airbag assembly rolled to a stop, the lander retracted the airbags, uprighted itself, and deployed the lander sidepetals. Then, the rover deployed its solar panels, panorama camera (Pancam) mast, and high gain antenna completing EDL phase of the mission. From this point, the egress phase began with the imaging of the landing site, pryo-release of the rover from the lander, pyro- cutting of the lander cabling, and the stand-up of the rover. Once these actions were completed, the rover was able to drive away from the lander.

SYSTEM THERMAL DESIGN DESCRIPTION

The thermal block diagram is shown in Figure 2 and the following thermal design description by mission phase helps place the diagram in proper context.

CRUISE PHASE

During the relatively quiescent flight from Earth to Mars, the cruise stage provides attitude control, propulsion, and power generation. The rover, buried in the entry vehicle, provides flight computer processing and telecommunication functions. The cornerstone of the cruise thermal design is the Heat Rejection System (HRS). This was a single-phase, mechanically pumped fluid loop. The redundant integrated pump assembly (IPA), located on the cruise stage, circulates the working fluid, CFC-11, throughout the cruise stage, lander, and Rover. The primary cruise heat sources are the telecommunications hardware, 6 radioisotope heat units (RHUS) on the battery, and the electronics located within the Rover warm electronics box (WEB). The fluid loop shuttles the Rover waste heat to radiators located on the periphery of the cruise stage. The design and performance of this system has been well do~umented.”~

To address lessons learned on MPF4, thermal design for the cruise stage propellant lines used the following upgraded features from the MPF design: 1) flight software controlled heaters, rather than mechanical bimetallic thermostats; 2) 8 distinct thermal regions, instead of 4; and 3) locating of line heaters at high heat loss areas (Le., propellant line mounting supports), rather

than a uniform heater power density over a control zone. Each control zone had two heaters for single point failure tolerance. The flight software enabled all 16 heaters, and staggered set-points were employed for the two heaters in a given zone to prevent simultaneous operation.

Heaters that are controlled by bimetallic thermostats were used throughout the flight system as required on the remaining hardware. Specific thermal finishes on the sun sensors, cruise solar array structure, and HRS radiators were used to maintain allowable flight temperature ranges. In the case of the cruise electronics module (CEM), it required a white radiator to contend with its relatively wide operational power variation. Thermal blanketing was conformally applied to much of the cruise stage hardware. A single-layer thermal blanket was applied to the heat shield to minimize lander heat loss.

EDL PHASE

The EDL hardware was maintained at non-operational temperature levels during cruise. As part of the EDL phase, thermal conditioning of the lander thermal batteries and the gas generators were performed. The lander battery temperatures were elevated from about -3OOC to O°C in about 5 hours with Kapton film heaters with bimetallic thermostats. The gas generators were warmed from about -26’C to -45OC in 1 hour through a command sequence. The remaining EDL hardware such as the parachute canister, descent rate limiter, RAD motors, TlRS motors, thermal battery, BPSA, BIMU, ARAs, and LPAs had non-operational levels that significantly overlapped the operational temperature ranges so no thermal conditioning was needed.

Prior to Mars entry, the HRS working fluid was vented, and for approximately 2 hours (from HRS venting to landing with the lander sidepetals deployed) the Rover battery, REM, and telecommunication hardware attached to the REM, relies on thermal capacitance to maintain allowable flight temperatures.

MARS SURFACE OPERATIONS PHASE

During surface operations, the Rover thermal design has two distinct zones: Internal to the Rover WEB and external to the Rover WEB.

Internal to the Rover WEB

The internal Rover design uses the relatively large thermal capacitance of the battery, REM, telecommunications hardware attached to the REM, and the MTES instrument to contend with the diurnal Martian thermal environment and the high power communication sessions during the Martian daytime. To this end, the Rover WEB was surrounded with opacified Aerogel insulation. The opacification reduced thermal radiation from the exterior to the WEB to the interior. Parasitic cable losses were reduced by maximizing the cable length through a “cable tunnel.” Nighttime “survival”

heaters were placed on the Rover battery, REM, and MTES to ensure that minimum non-operating temperature would be maintained. 6 RHUs on the Rover battery and 2 RHUs on the REM provided the best trade between minimizing nighttime heater power and preventing WEB overheating during the daytime. These RHUs conserved as much as 128 W-hr of nighttime battery energy. During high power telecommunication sessions during the Martian daytime, the insulated WEB acted as a calorimeter (Le., all the power being absorbed and manifested in a large temperature change). Here is where the WEB thermal capacitance was employed to dampen the transient WEB temperature increase.

Whereas the allowable flight temperature ranges of the REM, telecommunications hardware attached to the REM, and the MTES instrument were similar (approximately -40 to +4OoC), the Rover battery possessed allowable flight temperature limits which were tighter (-20 to +2OoC). Two heat switches that were attached to external radiators were used to modulate the RHU heat and to maintain the battery within its maximum allowable flight temperature limit5

External to the Rover WEB

The hardware with temperature requirements included:

0

0

0

0

e

0

e

e

e

e

e

0

High Gain Antenna Assembly (HGAA) Actuators Pancam Mast Assembly (PMA) Deployment Actuator Airbag Retraction Actuators (ARA) Lander Petal Deployment Actuators (LPA) Rocker Deployment Actuators Rover Lift Actuator (RLM) Solar Array Deployment Actuators Mobility Actuators (Drive and Steering) MTES Actuators Navcam Electronics Hazcam Electronics Instrument Deployment Device (IDD) Actuators

For these items, warm-up heaters were placed on the actuators to thermally condition the hardware prior to their use. The thermal conditioning requirements are

Figure 3: Propellant line, zone 1 includes fill valve that is mounted to CEM

shown in Table 1. Heaters were sized to warm the actuator from its minimum non-operation temperature limit to its minimum operation temperature limit in 1 hour, with a bus voltage of 24 V. Warm-up was accomplished through an uplinked command sequence.

Table 1 : External Rover Element Thermal Condition i ng Require men ts

Actuators (unless noted)

HGAA

PMA deployment, ARA, LPA, RLMe, & Solar array deployment

Rocker deployment & Rover lift mechanism

Mobility

MTES

Navcam/Pancam (Electronics) RAT

IDD

Warm-up Requirement

1 hr conditioning to enable use at 7:45 LST for first 20 Sols Enable operation between 12:30 & 18:OO LST on Sol 1 and 9:00 & 15:OO LST on subsequent 20 Sols Enable operation between 9:00 & 1500 LST for first 20 Sols Enable operation between 9:00 & 1500 LST 1 hr conditioning prior to use at any time 1 hr conditioning prior to use between 7:30 & 1500 LST Enable operation between 9:00 & 1500 LST 1 hr conditioning prior to use at 23:OO LST

The remaining external Rover elements such as the solar arrays, Rover LGA and UHF antennae, Pancam CCDs, Hazcam CCDs, Navcam CCDs, and WEB exterior had wide allowable flight temperature ranges that accommodated the expected Martian diurnal environment. Thermal conditioning was unnecessary. However, measures were taken to avoid bare metal finishes that could be illuminated by overhead solar flux.

THERMAL DESIGN LESSONS

CRUISE STAGE

Propulsion Fill Valve

After the MER-B system-level thermal balance test was performed, test instrumentation along one of the propellant line zones showed that it was 4'C below the minimum allowable flight temperature limit of 17OC for the worst-cold case (near Mars with an off-Sun angle of 45'). This zone, shown in Figure 3, consisted of the plumbing used to charge the propulsion system and tubing from the propulsion distribution module (PDM). Although the fill segment of the propellant line was not part of the active flow during flight, this portion required thermal control so that the propellant contained within would not freeze. The actual concern was line bursting caused by uneven thawing that could occur during Mars entry where the flight system is turned so that propellant lines could be illuminated by the Sun. Since the test

Figure 4: View from below CEM showing paper pattern for fill valve enclosing blanket

setup included a set of infrared quartz lamp arrays that blocked the solar array backside view to the chamber shroud, the test results were warmer than the corresponding flight condition. Analysis indicated that the fill valve temperature would decrease to 5OC, only 3OC from the propellant freezing point.

Post-test analysis suggested that the fill valve on the end of the fill tubing run was strongly influenced by the CEM via the support struts attached to the valve. The CEM had allowable flight temperature limits between -35 and 4OoC, while the propellant lines (including the fill valve) had a corresponding temperature limits between 17 and 5OoC. The fill valve was not sufficiently thermally isolated from the CEM, and thus negatively influencing the fill valve.

The fill valve thermal design modification involved 2 measures: 1) warm-biasing the CEM by covering its radiator area with a small thermal blanket, and 2) surrounding the fill valve with a "clam-shell" thermal blanket enclosure. These modifications can be seen in Figures 3 and 4. For cold-conservatism, only half the benefit of the clamshell blanket was used in the assessment of the redesign (Le., only 50% of the expected improvement in blanket effective emittance was assumed). Results from the worst-cold case thermal analysis of the modifications along with test data predicted that the fill valve would only reach 1 IoC, below the minimum allowable flight temperature limit of 17OC. However, any further warm-biasing of the CEM would jeopardize the CEM thermal design for its continuous worst-hot environment (sun-pointed solar array near Earth). The CEM controlled the thruster catalyst bed heaters used to thermally condition the thrusters prior to a trajectory correction maneuver (TCM). The first TCM was conducted near-Earth approximately 12 days after launch and the catalyst bed heaters were expected to be continuously operating for up to 15 hours in order to provide maximum flexibility in completing the TCM. With the warm-biasing of the CEM, this transient condition would result in a modest 3OC violation of the CEM's maximum allowable flight temperature limit of 5OoC. Given that the conservative nature of the cold case fill valve temperature prediction, the Project decided to

accept both the cold fill valve and the hot CEM temperature violations through waivers. The first TCM was actually conducted in about 8 hours and CEM overheating was experienced during the TCM.

Digital Sun Sensors

The 2 MPF -Z digital sun sensor (DSS) heads did not use any specific thermal surface finish although this permitted direct solar insolation of bare metal. Best thermal engineering practices attempts to avoid this type of design to the maximum extent practical. To this end, the -Z DSS head thermal design chose to use a low solar absorptancelhigh hemispherical emittance thermal finish for MER to contend with hardware requirement changes from MPF to MER. The MER DSS supplier indicated that hardware would be qualified at a lower temperature level than MPF (100 versus 105OC) and maximum allowable flight temperature limit was lower than MPF (80 versus 95OC). MER used recent institutional design practices, which dictated a 2OoC margin between qualification and allowable flight temperature limits. In fact, the original maximum allowable flight temperature limit for the MPF DSS head was 65OC and was raised to 95OC after a re-qualification was necessitated after MPF encountered challenges during hot system-level thermal balance testing. Worst- hot case analytical predictions for MER indicated a -Z DSS head temperature of 69OC, a margin of 11OC. The worst-hot case was actually a S/C safing attitude (solar array sun-pointed) near Earth.

For interchangeability with the DSS heads on the cruise stage structure that did not require any prescribed thermal finish, the DSS cognizant engineer procured all the DSS heads without any specified thermal finish. When the DSS cognizant engineer proposed relocating the -Z DSS to a more outboard location on the cruise solar array for pyroshock and contamination reduction reasons, the cruise stage thermal engineer learned that the specified finish had not be applied. The discovery was particularly unfavorable since the MER-B flight system had successfully completed its system-level thermal balance testing (the -Z DSS head was a non- flight model that was covered with silverized Teflon tape).

The decision whether to apply the specified thermal finish on the -Z DSS heads had profound implications both technical and programmatic:

0 Application of white paint was problematic since the masking of other sensitive surfaces was nearly impractical A possible alternative to paint, silverized Teflon tape, introduced the tape adhesive as a contamination source and the potential that the tape could release Since this challenge occurred during system-level test, the schedule delay could have consumed a large amount of the environmental test schedule slack.

0

0

I Silverized Teflon Finish

Figure 5: Both -2 DSS designs tested in MER-A system-level thermal balance test

An effort was undertaken to extrapolate the DSS head temperature based on its bare metal finish and the MER- B system-level test where the head had been taped. The analysis results for the worst-hot case suggested that the DSS head temperature would rise only 7OC when the finish was changed from silverized Teflon to bare metal. Thus, the maximum predicted -Z DSS head temperature was 75OC. The primary driver was the role of the solar array, which acted as a heat source for the taped head and acted as a heat sink for the bare head. There was a great deal of skepticism that the bare head would remain below the maximum allowable flight temperature limit of 8OoC for the worst-hot case.

Although MER-B had undergone its system-level thermal balance test, the MER-A system-level thermal balance test was about a month from its start. The lead thermal test engineer suggested that both -Z DSS head configurations (one bare finish and one taped with silverized Teflon) be installed for that test as shown in Figure 5. This opportunity was created by the test flow of identical flight systems and critical thinking at a system engineering perspective. The MER-A thermal balance test was performed as suggested, and the worst-case test results showed that the bare and taped head temperatures were 83 and 65OC, respectively. The MER-A taped head temperature agreed very well with the MER-B taped head temperature, 68OC. Although the bare head exceeded the maximum allowable flight temperature limit, the worst-hot case was considered a fault condition, where flight acceptance temperature limits would apply (+5OC beyond the maximum allowable flight temperature or 85OC). Since the flight acceptance limits were maintained and the test setup deemed hot- biased due to an infrared lamp array blocking the chamber shroud view for the solar array backside, the bare metal -Z DSS head was selected as the flight configuration. As a footnote, if the test resulted in the selection of the taped head, the decision had been made to use silverized Teflon tape to avoid schedule delay and to accept the contamination and tape-release risks.

LANDER

Backshell Inertial Reference Unit

During the EDL, the BlMU provided updated entry vehicle (backshell, heat shield, and lander with stowed Rover) attitude knowledge. The BlMU was located on the aeroshell, above one of the RAD motors (see Figure 6). Due its proximity to the cruise stage and launch vehicle adapter separation interface, this unit used mechanical shock isolation mounts. Unfortunately, this thermally isolated the BlMU from any conductive heat sink such as the BIP. Rejecting the BlMU internal power radiatively was also problematic. The exterior of the backshell structure was covered with a thermal protection material for the Mars entry aeroheating. The sidepetal airbag exterior represented the major radiative heat sink. The folded and stowed airbags were akin to thermal blankets, and thus fairly ineffective as a radiative heat path. Since its primary operation is about 3 to 4 hours during EDL, the BlMU thermal design relied on absorbing its internal power dissipation into its thermal capacitance.

The BlMU was maintained at -29OC with a thermostatic heater during the quiescent cruise. The operational allowable flight temperature limits were -39 to 5I0C. Therefore, the thermal design permitted the BlMU to warm from -29'C to no greater than 51OC. Preliminary analysis presuming a calorimetric calculation using the mass of the BlMU and its bracket demonstrated that a maximum of only 1.5 hours of operation was possible. Design options to create conductive paths to nearby heat sinks proved impractical. Options that increased the thermal capacitance were considered. While phase change materials appeared attractive, their exact implementation was deemed high-risk for schedule and budget reasons. The most feasible option involved a 0.9 kg addition of a relatively high specific heat material (e.g., beryllium) to the BlMU mounting bracket. This would enable 4 hours of operation. Even this option was unfavorable since additional ballast could be required to spin balance the flight system at a time in the development phase where mass margin was thin. The decision was made to fabricate the BlMU bracket with the mechanical provisions for attaching additional mass

RAD Motor (3 places)

p3 BlMU on @!! Mounting Plate

(3 places)

Bac kshell

Figure 6: BlMU mounting location on backshell

to it.

When the challenging thermal designs arise, development testing is an effective means for characterizing the current design and understanding the empirical thermal balance. In addition, empirical sensitivity can be quantified to assist in the design resolution to minimize the impact on system resources. The BlMU design was a prime candidate for such testing. The test article is shown in Figure 7 and additional mass to increase the overall thermal capacitance was excluded. The BlMU vendor indicated that there is a significant power dissipation variation (8 to 14 watts) from unit to unit. The test article dissipated about 9 watts, and under the EDL conditions, the BlMU temperature achieved a steady-state of 2OoC, well below the maximum allowable flight temperature limit of 51OC. However, when the 14-watt case (BIMU power dissipation plus 5 watts from a test heater), BlMU temperature rose from -20 to 5I0C in about 3 hours. A nominal test case considering 12-watt power dissipation resulted in a steady-state temperature of 63OC. Thus, the flight design would not add any mass to the BlMU bracket, but operational time would be limited to less than 2 hours at this time. When the BlMU flight units were delivered and power dissipation determined, a final decision regarding adding mass to the BlMU bracket would be made.

The delivered flight BlMUs had power dissipations around 9 watts so no further mass was added. During the MER-A and -B system-level thermal balance testing, functional tests were performed on the flight BIMUs, however, the test were insufficient to reach steady-state. This test data was extrapolated to predict the steady- state MER-A and -B temperatures at EDL (1 5 and 17OC, respectively, well below the maximum allowable flight temperature limit of 51OC).

ROVER

Actuator Warm-up Heaters

Warm-up heaters for external elements on the Rover were designed to meet the l-hour requirements shown in Table 1. The planned hardware implementation lacked

single point failure redundancy (Le., a single heater on a power switch). Initially, system engineer sought an exemption to the Level 2 single-point failure requirement since the most-likely expected failure would be a failed- open heater. Thus, the mission impact would be performance degradation since actuator usage would be delayed until the Martian environment naturally warmed the actuator above its minimum allowable flight operating temperature limit. However, good system engineering involves examining all paths of a fault tree. A credible scenario was identified where the Rover would wake-up from its overnight “sleep” mode to activate warm-up heaters and then return to the sleep mode. Upon Rover wake-up in the morning when the sunlight activates the solar array, the Rover would automatically shutdown warm-up heaters as part of its initialization process. If some fault occurred where the Rover failed to perform the morning wake-up, then the warm-up heaters could be left on indefinitely. Since heaters are sized to meet a 1 -hr warm-up requirement at minimum bus voltage (24 V), actuators are highly likely to become overheated sometime during the daytime, especially with the bus voltage being higher than the minimum value. Since all actuators undergo a dry-heat microbial reduction treatment (Le., vacuum bake-out at 1 10°C for 50 hours), the llO°C limit was established as the not-to-exceed level during a stuck-on warm-up heater situation. For the Navcam and Pancam electronics, this not-to-exceed limit was the maximum protoflight test level (85oC). Initial thermal analysis using heaters sized at minimum bus voltage showed that the PMA, HGAA, rocker deployment, and IDD actuators would exceed 1 10°C and the Navcam and Pancam electronics would exceed 85OC when the bus voltage was at a maximum of 33 V.

The initial step taken to rectify the situation was a re- specification of heater sizing requirement: Meet the 1 -hr warm-up requirement with a 28 V bus. This would mitigate the higher heater power dissipation in the stuck- on 33 V situation. Using this approach, the rocker deployment actuator and the Navcam and Pancam electronics were no longer overheating. However, the PMA, HGAA, and IDD actuators still overheated. During this design resolution, the thermal hardware (heaters and temperature sensors) was being integrated with the actuator hardware. JPL supplied end users with the actuators so sufficient lead-time was required to enable end users to deliver their hardware on schedule. Clearly, any design resolution for the remaining actuators would reside at the system-level since schedule was critical.

The problematic actuators were all associated with the warm-up heater enabling nighttime or early morning operation. The Rover thermal engineering team suggested the use of bimetallic thermostats to “cut-off‘ stuck-on heater. The proposed thermostats would be located on the exterior of the Rover, and would sense the diurnal Mars atmospheric temperature. The thermostat open and close set-points would be selected to turn off the warm-up heater by mid-morning and enable nighttime operation. By examining, the predicted first Sol’s atmospheric temperature provided by the MER Atmospheric Science Team, an open and close set-point

Figure 7: BlMU thermal development test article

Figure 9: Rover heater thermostat assembly

temperature of -3OOC was selected for assessment. Thermal analysis using this set-point demonstrated that the Pancam and HGAA actuators would be protected from overheating in a heater stuck-on fault condition. However, the IDD actuators had a small 2-hour window from 500 to 7:OO LST where the actuators still would overheat since the thermostat had not cut-off the warm- up heater. In order to prevent the IDD actuators from overheating, an open and close set-point of -7OOC would be required. This would preclude early morning operation of the IDD since the IDD warm-up would be cut-off before sufficient thermal conditioning. The optimal balance between technical and programmatic risk pointed toward the use of thermostats with a -3OOC set- point.

The availability of space-qualified thermostats posed a formidable challenge for this implementation. High- reliability space-qualified thermostats typically required 3 to 6 months lead time for a new build. A more expedient approach would be to canvas thermostat vendors for their residual stock. This approach proved successful when 30 previously flight-qualified thermostats were located with a set-point of -4OOC and procured in about 2 months. The lower set-point than the specified -3OOC was acceptable since it did not significant change the cut-off or return to operation times. As a footnote, only 4 thermostats with -7OOC setpoint were located and at least 8 thermostats were required for the MER flight build.

A total of 5 warm-up heaters circuits throughout the PMA, HGAA, and IDD were cabled through the Rover heater thermostat assembly that housed all 5 thermostats. The chassis of the Rover heater thermostat assembly was fabricated from carbon-fiber composite so there was no thermal expansion mismatch with its mounting location on the Rover WEB (also made from a carbon fiber composite). The exterior of the chassis was coated with space-qualified white paint to reduce the impact of solar flux impingement during the early morning; the Rover solar array provided Sun shading most of the daytime. The interior of the assembly was coated with vapor-deposited aluminum to radiatively isolate the assembly from the WEB. The thermostats were mounted to the top of the assembly to minimize their conductive path to the WEB. The hardware is shown in Figure 8 and the mounting location on the Rover is shown in Figure 9.

When MER-B (Opportunity) landed on Mars on January 25, 2004, an anomalous nighttime current draw was detected. A stuck-on IDD warm-up heater was initially suspected. Unfortunately, there were only flight temperature sensors on 2 of the 5 IDD actuators, and the suspected actuator with the stuck-on heater had a flight temperature sensor that failed during the Rover thermal balance testing. Because of the high risk for an in-situ repair, the Project opted to forego replacement of this temperature sensor. However, inferred diagnosis of flight power and temperature telemetry strongly verified that one of the IDD heater circuits was stuck-on. One unmistakable piece of evidence that led to this conclusion was the timing of this anomalous load. The load would be shed around 1O:OO LST and then return about 12 hours later. Using flight temperature telemetry from other external Rover elements led to an approximation for the atmospheric temperature and the times that the anomalous current was shed and re- established corresponded very closely with the thermostat set-points of that IDD heater circuit. The Rover heater thermostat assembly was performing as designed and protected the IDD actuators from overheating. Another important attribute was the nighttime energy savings. Without the Rover heater thermostat assembly, approximately 180 W-hr would have been consumed from the Rover battery. This could have jeopardized the ability to carry out the 90 Martian day primary mission. Although a fault scenario was permitted to drive the thermal hardware implementation, the protective measures proved invaluable.

CONCLUSION

Despite the most proactive planning and preparation, thermal design challenges arise throughout the entire design and implementation life cycle. Programmatic factors such as budget and schedule tend to further complicate the situation. The resolution of these challenges requires a systems engineering perspective since thermal design usually crosses over several subsystem boundaries.

Figure 8: Installed Rover heater thermostat assembly

ACKNOWLEDGMENTS

The research described in this paper was carried out at the Jet Propulsion Laboratory, California Institute of Technology, under a contract with the National Aeronautics and Space Administration. Eug-Yun Kwack and Gary Kinsella assisted with the cold fill valve issue. Allan Eisenman served as the DSS hardware cognizant engineer and provided invaluable advice. Mark Duran and Pamela Hoffman implemented the CEM thermal hardware modification for the cold fill valve and DSS resolutions. George Chen, Edward Konefat, Edward Litty, and Edward Swenka of the MER Attitude Control Team assisted with the resolution of the BlMU thermal design. Jacqueline Lyra provided thermal system engineering support for the BlMU issue. Anthony Paris assisted with the BlMU thermal development test planning, preparation, and execution. Rick Welch, the MER chief systems engineer, spearheaded the effort to address the Rover warm-up heater issue. Chern-Jiin Lee and Siu-Chun Lee, both from Applied Science Laboratory, provided warm-up heater thermal analysis support. Gerald Gaugen and Stanley Winstein oversaw the design, fabrication, and assembly of the Rover heater thermostat assembly. Walter Walker and Gus Forsberg provided thermal coating support for the Rover heater thermostat assembly. Richard Cook and Barry Goldstein were the MER flight system manager and deputy manager, respectively, and were involved with all the decisions regarding the issues presented herein.

This paper is dedicated to my wife, Tammy Akahoshi and my father, Shigeru Tsuyuki. My wife endured many a day during the MER development raising our daughter without me, and my father passed away quietly on November 28, 2004 after a 14-month battle with cancer.

REFERENCES

1. Roncoli, R. and Ludwinski, J., “Mission Design Overview for the Mars Exploration Rover Mission,” presented at AlAAlAAS Astrodynamics Specialist Conference, August 5-8, 2002, Monterey, California.

2. Ganapathi, G., Birur, G., Tsuyuki, G., McGrath, P., and Patzold, J. “Active Heat Rejection System on Mars Exploration Rover - Design Changes from Mars Pathfinder,” Proceedings of the Space Technology and Applications International Forum, 2003. Institute of Space and Nuclear Studies, Albuquerque, NM. February 2003.

3.

4.

5.

Ganapathi, G., Birur, Tsuyuki, G., and Krylo, R. “Mars Exploration Rover Heat Rejection System Performance Comparison of Ground and Flight Data,” Proceedings of the International Conference on Environmental Systems, Paper 041CES-283, Colorado Springs, CO, July 2004. Novak, K. “MPF Propellant Line Thermal Design Lessons Learned,” Proceedings of the 8‘h Spacecraft Thermal Control Technology Workshop, El Segundo, CA, March 1997. Sunada, E, “Paraffin Actuated Heat Switch: Flight Implementation and Performance on the Mars Exploration Rovers,” Proceedings of the Space Technology and Applications International Forum, 2004. Institute of Space and Nuclear Studies, Albuquerque, NM. February 2004.

DEFINITIONS, ACRONYMS, ABBREVIATIONS

ARA: Airbag Retraction Actuator BIMU: Backshell Inertial Measurement Unit BIP: Backshell Interface Plate BPSA: Backshell Pyro CCD: Charged Couple Device DSS: Digital Sun Sensor EDL: Entry, Descent, & Landing HGAA: High Gain Antenna Assembly HRS: Heat Rejection System IDD: Instrument Deployment Device IPA: Integrated Pump Assembly KSC: Kennedy Space Center LGA: Low Gain Antenna LPA: Lander Petal Actuator LST: Local Solar Time MER: Mars Exploration Rover MPF: Mars Pathfinder MTES: Miniature Thermal Emission Spectrometer PMA: Pancam Mast Assembly RAD: Rocket Assisted Deceleration REU: Remote Engineering Unit REM: Rover Electronics Module RHU: Radioisotope Heater Unit RLM: Rover Lift Mechanism TIRS: Transverse Impulse Rocket System UHF: Ultra High Frequency v: Volts W-hr: Watt-hour, a measure of energy usage WEB: Warm Electronics Box

Jet Propukion Laboratory California Institute of Technology

4800 Oak Grove Drive Pasadena, Calilornia 91 109.8099

(el 8) 354-4321

JET PROPULSION LABOR~TORY CALIFORNIA INSTITUTE OF TECHNOLOGY

Authorization for Public Release and Transfer of Copyright

The contribution entitled “The Mars Exploration Rover: Thermal Design is a System Engineering Activity” by G. Tsuyuki, A. Avila, H. Awaya, et a1 submitted for publication in the 2004 ICES has been cleared for public release by the Jet Propulsion Laboratory, California Institute of Technology. The copyright to the Contribution is transferred to: The Engineering Society for Advanced Mobility Land Sea Air and Space (SAE) when the Contribution is published by the above-named publisher, with the following reservation of rights:

This Contribution was produced by (a) members(s1 of the Jet Prbpulsion Laboratory, California Institute of Technology and is considered a work-for-hire. In accordance with the contract between the California Institute of Technology and the National Aeronautics and Space Administration, the United States Government and others acting on its behalf shall have, for Governmental purposes, a royalty-free, nonexclusive, irrevocable, world-wide license to publish, distribute, copy, exhibit and perform the work, in whole or in part, to authorize others to do so, to reproduce the final published and/or electronic form of the Contribution, to include the work on the NASA/JPL Technical Reports Server web site, and to prepare derivative works including, but not limited to, abstracts, lectures, lecture notes, press releases, reviews, textbooks, reprint books, and translations.

I, as an author, represent that AUTHORIZED REPRESENTATIVE I am authorized to sign for and on behalf of all authors, and that this agreement is made on behalf of all the authors. (Signat re) (Date)

“r/iClL O ( L d + y Name: w & k y && 0 f i&;&d

3 5/10/0 q (Date) Logistics & Technical information

Divi s ion JET PROPULSION LABORATORY Name : G \ q . ~ m T . TCUVC+(CL - i CALIFORNIA INSTITUTE OF TECHNOLOGY

PLEASE RETURN TO: Judy L. Zelent

E-mail: techmuer@sae.org

Phone: (1) 724-772-7176 Fax: (1) 724-776-4670

ASSIGNMENT

This Assignment is effective this E day of m, 200E, by and between the Society of Automotive Engineers, Inc., a corporation of Pennsylvania having a place of business at 400 Commonwealth Drive, Warrendaie, PA 15096-0001 (“SAE”) and

Author(s))Glenn T. Tsuyuki, AThlro Avila, Henry 1. Awaya. Rspert J. Krylo, Keith S. Nqvak, and Charles J. Phillips I Glenn T. Tsuyuki, Arturo Avila, Henry I. Awaya, Robert J. Krylo, Keith S. Novak, and Charles J. Phillips

Paper #: 12004-01-2411 SAE Meeting: ICES

Title of work 1 Mars Exploration Rover: Thermal Design is a System Engineering (“Work”). If fie Work is a work-made-for-hire pursuant to 17 USC 0 101 of the Copyright Act, then such undersigned entity (e.g., employer) shall be deemed the Author for purposes of this Assignment (“Assignof’).

Assignor represents and guarantees the Work is an original unpublished work, that no portion of the Work is covered by a prior copyright; or, for any portion copyrighted, the author has obtained permission for its use, and that the Work contains no material whose publication would violate any copyright or other personal or proprietary right of any person or entity. Assignor acknowledges this Work is not a work made for the United States Government.

For consideration, receipt of which is acknowledged, Assignor hereby assigns all right, title and interest in and to Assignor‘s copyright in the exclusive right to reproduce and distribute copies of the Work. Assignment of the reproduction and distribution copyright shall include all medium and format throughout the universe. SAE shall have the right with respect to all or part of the Work to edit, annotate, comment, formatheformat and abstract the Work or incorporate it into a compilation or other work. No other exclusive rights in the Work are hereby assigned.

Revised 11/01/2001

2004-01 -241 1

Mars Exploration Rover: Thermal Design is a System Engineering Activity

Glenn T. Tsuyuki, Arturo Avila, Henry I. Awaya, Robert J. Krylo, Keith S. Novak, and Charles J. Phillips

Jet Propulsion Laboratory, California Institute of Technology

Copyright 0 2004 SAE lntemational

ABSTRACT

The Mars Exploration Rovers (MER), were launched in June and July of 2003, respectively, and successfully landed on Mars in early and late January of 2004, respectively. The flight system architecture implemented many successful features of the Mars Pathfinder (MPF) system: A cruise stage that transported an entry vehicle that housed the Lander, which in turn, used airbags to cushion the Rover during the landing event. The initial thermal design approach focused on adopting the MPF design wherever possible, and then concentrating on the totally new Rover thermal design. Despite a fundamentally sound approach, there were several salient lessons learned. Some were due to differences from MPF, while others were caused by other means. These lessons sent a clear message: thermal design continues to be a system engineering activity. In each major flight system assembly, there were excellent examples of this recurring theme. From the cruise stage, the cascading impact of a propulsion fill and drain valve thermal design change after system level test is described. In addition, we present the interesting resolution of the sun sensor head thermal design (bare metal versus white paint). The final implementation went against best thermal engineering practices. For the entry vehicle consisting of the aeroshell and equipment mounted to it, an inertial measurement unit mounted on a shock-isolation fixture presented a particularly difficult design challenge. We initially believed that its operating time would be limited due to its relatively low mass and high power dissipation. We conclude with the evolution of the Rover actuator thermal design where the single- string warm-up heaters were employed. In this instance, fault protection requirements drove the final thermal design implementation, and in the case of Opportunity, proved to be critical for meeting primary mission lifetime.

INTRODUCTION

In July 2000, with a little less than three years to launch, NASA formally approved a dual rover mission to Mars, known as the Mars Exploration Rover (MER) Project.

The primary mission objectives were to determine the aqueous, climatic, and geologic history of a pair of sites on Mars where the conditions may have been favorable to the preservation of evidence of pre-biotic or biotic processes. The primary missions requirements sought to deliver two identical rovers to the surface of Mars in order to conduct geologic and atmospheric investigations for at least 90 Sols (approximately 93 Earth days) after landing and to demonstrate a total traverse distance of at least 600 m, with a goal of 1000 m'.

The MER flight system design adapted many successful features of the Mars Pathfinder (MPF) spacecraft design that was launched in 1996 and landed on Mars on July 4, 1997. During cruise, MER was a spin-stabilized spacecraft with a nominal spin rate of 2 revolutions per minute (rpm). The MER flight system consists of four major components: cruise stage, entry, descent, and landing (EDL) system, Lander structure, and the Rover. The mass allocation for the entire flight system (including propellant load) was 1065 kg. The cruise configuration is

- Crulte Stage

t 1.7 m

1

acksl

f ha' Rover

Lander

c Heat Shleld

Figure 1: MER flight system configuration

Figure 2: Thermal System Block Diagram

I

,

CRUISE STAGE H RS

R AD IATO R .

SCAHHER

Cruise Shunt I . R adiator

HPCs . 4

A

RAD MOTORS (3) TIR MOTORS (3)

I I I I I LAHDER 1

Solar Array Deploy.

PlvlcI Mast Deploy 8 IDD Actuators

HGA(nwtor&gearbox) PMA Az (bearings)

Parachute Mortar Canister

I DIMES CCD I

GAS GEHERATOR (3)

I 1-1 I LAHDER 1 PRI BATTERY (5) 1 I RADAR 1 I L P f i LPA Elect ron ics (3) e+ Lander Basepetal CMD

RADAR ALTIME TE R 1 E lect ron ics 1 1 RLM Elect ron ics CMD

S# FSW Controlled Mechanical Thermostat (Dual Redundancy) PRT (Read bythe CSIDXPCU ) CruiseHeater w r m - u p Heater CMD Commadable Mechanical Thermostat (Single St r ing) e PRT (Read bytheLEM REU)

Pre EDLvEDL Heater e3 H i g l a n l e l l e a t W Usage+!* over T e n p Mechanical Thermostat (w;i ThermosQt BOX) Sur fOpHeater l x ! _- HRS Vent Pyro PRT (Read by the CEM RE U) PRT (Read bythe BCB)

PRT (Read b y t h e R E M Payload I + Board)

shown in Figure 1.

The two Mars Exploration Rover missions were designated as MER-A (Spirit) and MER-B (Opportunity). The first spacecraft (MER-A) was launched on June 10, 2003 atop a Boeing Delta II 7925 launch vehicle from Kennedy Space Center (KSC). The second spacecraft was launched on July 8, 2003 on a Boeing Delta II 7925H. Approximately 7 months after each launch, the spacecrafts entered the Martian atmosphere directly from their interplanetary trajectories. Similar to the MPF mission, the MER entry trajectory followed an unguided, ballistic descent. The spacecraft relied upon a heatshield and parachute to slow its descent through the Martian atmosphere, fired retro-rockets to reduce its vertical landing velocity, and finally deployed airbags to cushion its impact with the surface. After the airbag assembly rolled to a stop, the lander retracted the airbags, uprighted itself, and deployed the lander sidepetals. Then, the rover deployed its solar panels, panorama camera (Pancam) mast, and high gain antenna completing EDL phase of the mission. From this point, the egress phase began with the imaging of the landing site, pryo-release of the rover from the lander, pyro- cutting of the lander cabling, and the stand-up of the rover. Once these actions were completed, the rover was able to drive away from the lander.

SYSTEM THERMAL DESIGN DESCRIPTION

The thermal block diagram is shown in Figure 2 and the following thermal design description by mission phase helps place this diagram in proper context.

CRUISE PHASE

During the relatively quiescent flight from Earth to Mars, the cruise stage provides attitude control, propulsion, and power generation. The rover, nestled within the entry vehicle, provides flight computer processing and telecommunication functions. The cornerstone of the cruise thermal design was the Heat Rejection System (HRS). This was a single-phase, mechanically pumped fluid loop. The redundant integrated pump assembly (IPA), located on the cruise stage, circulated the working fluid, CFC-11, throughout the cruise stage, lander, and Rover. The primary cruise heat sources were the telecommunications hardware, 6 radioisotope heat units (RHUS) on the battery, and the electronics located within the Rover warm electronics box (WEB). The fluid loop shuttled the Rover waste heat to radiators located on the periphery of the cruise stage. The design and performance of this system has been well do~umented.~’~

To address lessons learned on MPF4, thermal design for the cruise stage propellant lines used the following upgraded features from the MPF design: 1) flight software controlled heaters, rather than mechanical bimetallic thermostats; 2) 8 distinct thermal regions, instead of 4; and 3) locating of line heaters at high heat loss areas (i.e., propellant line mounting supports), rather

than a continuous film heater overwrap on a control zone. Each control zone had two heaters for single point failure tolerance. The flight software enabled all 16 heaters, and staggered set-points were employed for the two heaters in a given zone to prevent simultaneous operation.

Heaters that are controlled by bimetallic thermostats were used throughout the flight system as required on the remaining hardware. Specific thermal finishes on the sun sensors, cruise solar array structure, and HRS radiators were used to maintain allowable flight temperature ranges. In the case of the cruise electronics module (CEM), it required a white radiator to contend with its relatively wide operational power variation. Thermal blanketing was conformally applied on much of the cruise stage hardware. A single-layer thermal blanket was applied to the heat shield to minimize lander heat loss.

EDL PHASE

The EDL hardware was maintained at non-operational temperature levels during cruise. As part of the EDL phase, thermal conditioning of the lander thermal batteries and the gas generators was performed. The lander battery temperatures were elevated from about -3OOC to O°C in about 5 hours with Kapton film heaters with bimetallic thermostats. The gas generators were warmed from about -26’C to -15OC in 1 hour through a command sequence. The remaining EDL hardware such as the parachute canister, descent rate limiter, RAD motors, TlRS motors, thermal battery, BPSA, BIMU, ARAs, and LPAs had non-operational levels that significantly overlapped the operational temperature ranges so no thermal conditioning was needed.

Prior to Mars entry, the HRS working fluid was vented, and for approximately 2 hours (from HRS venting to landing with the lander sidepetals deployed) the Rover battery, REM, and telecommunication hardware attached to the REM, relied on thermal capacitance to maintain allowable flight temperatures.

MARS SURFACE OPERATIONS PHASE

During surface operations, the Rover thermal design had two distinct zones: Internal to the Rover WEB and external to the Rover WEB.

Internal to the Rover WEB

The internal Rover design used the relatively large thermal capacitance of the battery, REM, telecommunications hardware attached to the REM, and the MTES instrument to contend with the diurnal Martian thermal environment and the high power communication sessions during the Martian daytime. To this end, the Rover WEB was surrounded with opacified Aerogel insulation. The opacification reduced thermal radiation from the exterior of the WEB to the interior. Parasitic cable losses were reduced by maximizing the cable

length through a “cable tunnel.” Nighttime “survival” heaters were placed on the Rover battery, REM, and MTES to ensure that minimum non-operating temperature would be maintained. 6 RHUs on the Rover battery and 2 RHUs on the REM provided the best trade between minimizing nighttime heater power and preventing WEB overheating during the daytime. These RHUs conserved as much as 128 W-hr of nighttime battery energy. During high power telecommunication sessions during the Martian daytime, the insulated WEB acted as a calorimeter (i.e., all the power being absorbed and manifested in a large temperature change). Here was where the WEB thermal capacitance was employed to dampen the transient WEB temperature increase.

Actuators (unless noted)

HGAA

PMA deployment, ARA, LPA, RLMe, & Solar array deployment

Rocker deployment & Rover lift mechanism

Mobility

MTES

Navcam/Pancam (Electronics) RAT

IDD

Whereas the allowable flight temperature ranges of the REM, telecommunication hardware attached to the REM, and the MTES instrument were similar (approximately -40 to +4OoC), the Rover battery possessed allowable flight temperature limits which were narrower (-20 to +2OoC). Two heat switches that were attached to external radiators were used to modulate the RHU heat and to maintain the battery within its maximum allowable flight temperature ~ i m i t . ~

Warm-up Requirement

1 hr conditioning to enable use at 7:45 LST for first 20 Sols Enable operation between 12:30 & 18:OO LST on Sol 1 and 9:00 & 15:OO LST on subsequent 20 Sols Enable operation between 9:00 & 1500 LST for first 20 Sols Enable operation between 9:00 & 15:OO LST 1 hr conditioning prior to use at any time 1 hr conditioning prior to use between 7:30 & 1500 LST Enable operation between 9:00 & 1500 LST 1 hr conditioning prior to use at 23:OO LST

External to the Rover WEB

The hardware with temperature requirements included:

High Gain Antenna Assembly (HGAA) Actuators Pancam Mast Assembly (PMA) Deployment Actuator Airbag Retraction Actuators (ARA) Lander Petal Deployment Actuators (LPA) Rocker Deployment Actuators Rover Lift Actuator (RLM) Solar Array Deployment Actuators Mobility Actuators (Drive and Steering) MTES Actuators Navcam Electronics Hazcam Electronics Instrument Deployment Device (IDD) Actuators

For these items, warm-up heaters were placed on the actuators to thermally condition the hardware prior to their use, if needed. The thermal conditioning

Figure 3: Propellant line, zone 1 includes fill valve that is mounted to CEM

The remaining external Rover elements such as the solar arrays, Rover LGA and UHF antennae, Pancam CCDs, Hazcam CCDs, Navcam CCDs, and WEB exterior had wide allowable flight temperature ranges that accommodated the expected Martian diurnal environment. Thermal conditioning was unnecessary. However, measures were taken to avoid bare metal finishes that could be illuminated by overhead solar flux.

THERMAL DESIGN LESSONS

CRUISE STAGE

Propulsion Fill Valve

After the MER-B system-level thermal balance test was performed, test instrumentation along one of the propellant line zones showed that it was 4OC below the minimum allowable flight temperature limit of 17OC for the worst-cold case (near Mars with an off-Sun angle of 45’). This zone, shown in Figure 3, consisted of the plumbing used to charge the propulsion system and tubing from the propulsion distribution module (PDM). Although the fill segment of the propellant line was not part of the active flow during flight, this portion required thermal control so that the propellant contained within would not freeze. The actual concern was line bursting caused by uneven thawing. This could occur during Mars entry where the flight system is turned so that propellant lines could be illuminated by the Sun. Since the test

Figure 4: View from below CEM showing paper pattern for fill valve enclosing blanket

setup included a set of infrared quartz lamp arrays that blocked the solar array backside view to the chamber shroud, the test results were warmer than the corresponding flight condition. Analysis indicated that the fill valve temperature would decrease to 5OC, only 3OC from the propellant freezing point.

Post-test analysis suggested that the fill valve on the end of the fill tubing run was strongly influenced by the CEM via the support struts attached to the valve. The CEM had allowable flight temperature limits between -35 and 4OoC, while the propellant lines (including the fill valve) had a corresponding temperature limits between 17 and 5OoC. The fill valve was not sufficiently thermally isolated from the CEM, and Thus, a cool CEM contributed to overcooling the valve.

The fill valve thermal design modification involved 2 measures: 1) warm-biasing the CEM by covering its radiator area with a small thermal blanket, and 2) surrounding the fill valve with a "clam-shell" thermal blanket enclosure. These modifications can be seen in Figures 3 and 4. For cold-consewatism, only half the benefit of the clamshell blanket was used in the assessment of the redesign (i.e., only 50% of the expected improvement in blanket effective emittance was assumed). Results from the worst-cold case thermal analysis of the modifications along with test data predicted that the fill valve would only reach 1 l0C, below the minimum allowable flight temperature limit of 17OC. However, any further warm-biasing of the CEM would jeopardize the CEM thermal design for its continuous worst-hot environment (sun-pointed solar array near Earth). The CEM controlled the thruster catalyst bed heaters used to thermally condition the thrusters prior to a trajectory correction maneuver (TCM). The first TCM was conducted near-Earth approximately 12 days after launch and the catalyst bed heaters were expected to be continuously operating for up to 15 hours in order to provide maximum flexibility in completing the TCM. With the warm-biasing of the CEM, this transient condition would result in a modest 3OC violation of the CEM's maximum allowable flight temperature limit of 5OoC. Given that the conservative nature of the cold case fill valve temperature prediction, the Project decided to

accept both the cold fill valve and the hot CEM temperature violations through waivers. The first TCM was actually conducted in about 8 hours and CEM overheating was not experienced during the TCM.

Diclital Sun Sensors

The 2 MPF -Z digital sun sensor (DSS) heads did not use any specific thermal surface finish although this permitted direct solar insolation of bare metal. Best thermal engineering practices attempts to avoid this type of design to the maximum extent practical. To this end, the -Z DSS head thermal design chose to use a low solar absorptancelhigh hemispherical emittance thermal finish for MER to contend with hardware requirement changes from MPF to MER. The MER DSS supplier indicated that hardware would be qualified at a lower temperature level than MPF (100 versus 105OC) and the maximum allowable flight temperature limit was lower than MPF (80 versus 95OC). MER used recent institutional design practices, which dictated a 2OoC margin between qualification and allowable flight temperature limits. In fact, the original maximum allowable flight temperature limit for the MPF DSS head was 65OC and was raised to 95OC after a re-qualification was necessitated after MPF encountered challenges during hot system-level thermal balance testing. Worst- hot case analytical predictions for MER indicated a -2 DSS head temperature of 69OC, a margin of 11OC. The worst-hot case was actually a S/C safing attitude (solar array sun-pointed) near Earth.

For interchangeability with the DSS heads on the cruise stage structure that did not require any prescribed thermal finish, the DSS cognizant engineer procured all the DSS heads without any specified thermal finish. When the DSS cognizant engineer proposed relocating the -Z DSS to a more outboard location on the cruise solar array for pyroshock and contamination reduction reasons, the cruise stage thermal engineer learned that the specified finish had not be applied. The discovery was particularly unfavorable since the MER-B flight system had successfully completed its system-level thermal balance testing (the -Z DSS head was a non- flight model that was covered with silverized Teflon tape).

The decision whether to apply the specified thermal finish on the -Z DSS heads had profound implications both technical and programmatic:

0 Application of white paint was problematic since the masking of other sensitive surfaces was nearly impractical A possible alternative to paint, silverized Teflon tape, introduced the tape adhesive as a contamination source and the potential that the tape could release Since this challenge occurred during system-level test, the schedule delay could have consumed a large amount of the environmental test schedule slack.

0

0

ilverized Tefk Finish

LANDER

Backshell Inertial Reference Unit

Figure 5: Both -2 DSS designs tested in MER-A system-level thermal balance test

An effort was undertaken to extrapolate the DSS head temperature based on its bare metal finish and the MER- B system-level test where the head had been taped. The analysis results for the worst-hot case suggested that the DSS head temperature would rise only 7OC when the finish was changed from silverized Teflon to bare metal. Thus, the maximum predicted -Z DSS head temperature was 75OC. The primary driver was the role of the solar array, which acted as a heat source for the taped head and acted as a heat sink for the bare head. There was a great deal of skepticism that the bare head would remain below the maximum allowable flight temperature limit of 8OoC for the worst-hot case.

Although MER-B had undergone its system-level thermal balance test, the MER-A system-level thermal balance test was about a month from its start. The lead thermal test engineer suggested that both -Z DSS head configurations (one bare finish and one taped with silverized Teflon) be installed for that test as shown in Figure 5. This opportunity was created by the test flow of identical flight systems and critical thinking at a system engineering perspective. The MER-A thermal balance test was performed as suggested, and the worst-case test results showed that the bare and taped head temperatures were 83 and 65OC, respectively. The MER-A taped head temperature agreed very well with the MER-B taped head temperature, 68OC. Although the bare head exceeded the maximum allowable flight temperature limit, the worst-hot case was considered a fault condition, where flight acceptance temperature limits would apply (+5OC beyond the maximum allowable flight temperature or 85OC). Since the flight acceptance limits were maintained and the test setup deemed hot- biased due to an infrared lamp array blocking the chamber shroud view for the solar array backside, the bare metal -Z DSS head was selected as the flight configuration. As a footnote, if the test resulted in the selection of the taped head, the decision had been made to use silverized Teflon tape to avoid schedule delay and to accept the contamination and tape-release risks.

During the EDL, the BlMU provided updated entry vehicle (backshell, heat shield, and lander with stowed Rover) attitude knowledge. The BlMU was located on the aeroshell, above one of the RAD motors (see Figure 6). Due its proximity to the cruise stage and launch vehicle adapter separation interface, this unit used mechanical shock isolation mounts. Unfortunately, this thermally isolated the BlMU from any conductive heat sink such as the BIP. Rejecting the BlMU internal power radiatively was also problematic. The exterior of the backshell structure was covered with a thermal protection material for the Mars entry aeroheating. The sidepetal airbag exterior represented the major radiative heat sink. The folded and stowed airbags were akin to thermal blankets, and thus fairly ineffective as a radiative heat path. Since its primary operation was about 3 to 4 hours during EDL, the BlMU thermal design relied on absorbing its internal power dissipation into its thermal capacitance.

The BlMU was maintained at -29OC with a thermostatic heater during the quiescent cruise. The operational allowable flight temperature limits were -39 to 51OC. Therefore, the thermal design permitted the BlMU to warm from -29'C to no greater than 51OC. Preliminary analysis presuming a calorimetric calculation using the mass of the BlMU and its bracket demonstrated that a maximum of only 1.5 hours of operation was possible. Design options to create conductive paths to nearby heat sinks proved impractical. Options that increased the thermal capacitance were considered. While phase change materials appeared attractive, their exact implementation was deemed high-risk for schedule and budget reasons. The most feasible option involved a 0.9 kg addition of a relatively high specific heat material (e.g., beryllium) to the BlMU mounting bracket. This would enable 4 hours of operation. Even this option was unfavorable since additional ballast could be required to spin balance the flight system at a time in the development phase where mass margin was thin. The decision was made to fabricate the BlMU bracket with the mechanical provisions for attaching additional mass

RAD Motor (3 places)

Backs hell

Figure 6: BlMU mounting location on backshell

to it.

When challenging thermal designs arise, development testing is an effective means for characterizing the current design and understanding the empirical thermal balance. In addition, empirical sensitivity can be quantified to assist in the design resolution to minimize the impact on system resources. The BlMU design was a prime candidate for such testing. The test article is shown in Figure 7 and additional mass to increase the overall thermal capacitance was excluded. The BlMU vendor indicated that there was a significant power dissipation variation (8 to 14 watts) from unit to unit. The test article dissipated about 9 watts, and under the EDL conditions, the BlMU temperature achieved a steady- state of 2OoC, well below the maximum allowable flight temperature limit of 51OC. However, when the 14-watt case (BIMU power dissipation plus 5 watts from a test heater), BlMU temperature rose from -20 to 5loC in about 3 hours. A nominal test case considering 12-watt power dissipation resulted in a steady-state temperature of 63OC. Thus, the flight design would not add any mass to the BlMU bracket, but operational time would be limited to less than 2 hours at this time. When the BlMU flight units were delivered and power dissipation determined, a final decision regarding adding mass to the BlMU bracket would be made.

The delivered flight BlMUs had power dissipations around 9 watts so no further mass was added. During the MER-A and -B system-level thermal balance testing, functional tests were performed on the flight BIMUs, however, the test were insufficient to reach steady-state. This test data was extrapolated to predict the steady- state MER-A and -B temperatures at EDL (1 5 and 17OC, respectively, well below the maximum allowable flight temperature limit of 51OC).

ROVER

Actuator Warm-uD Heaters

Warm-up heaters for external elements on the Rover were designed to meet the l-hour requirements shown in Table 1. The planned hardware implementation lacked

The problematic actuators were all associated with the warm-up heater enabling nighttime or early morning operation. The Rover thermal engineering team suggested the use of bimetallic thermostats to “cut-off’ stuck-on heater. The proposed thermostats would be located on the exterior of the Rover, and would sense the diurnal Mars atmospheric temperature. The thermostat open and close set-points would be selected to turn off the warm-up heater by mid-morning and enable nighttime operation. By examining, the predicted first Sol’s atmospheric temperature provided by the MER Atmospheric Science Team, an open and close set-point

single point failure redundancy (Le., a single heater on a power switch). Initially, system engineer sought an exemption to the Level 2 single-point failure requirement since the most-likely expected failure would be a failed- open heater. Thus, the mission impact would be performance degradation since actuator usage would be delayed until the Martian environment naturally warmed the actuator above its minimum allowable flight operating temperature limit. However, good system engineering involves examining all paths of a fault tree. A credible scenario was identified where the Rover would wake-up from its overnight “sleep” mode to activate warm-up heaters and then return to the sleep mode. Upon Rover wake-up in the morning when the sunlight activates the solar array, the Rover would automatically shutdown warm-up heaters as part of its initialization process. If some fault occurred where the Rover failed to perform the morning wake-up, then the warm-up heaters could be left on indefinitely. Since heaters are sized to meet a l-hr warm-up requirement at minimum bus voltage (24 V), actuators are highly likely to become overheated sometime during the daytime, especially with the bus voltage being higher than the minimum value. Since all actuators undergo a dry-heat microbial reduction treatment (Le., vacuum bake-out at 1 10°C for 50 hours), the llO°C limit was established as the not-to-exceed level during a stuck-on warm-up heater situation. For the Navcam and Pancam electronics, this not-to-exceed limit was the maximum protoflight test level (85oC). Initial thermal analysis using heaters sized at minimum bus voltage showed that the PMA, HGAA, rocker deployment, and IDD actuators would exceed 1 10°C and the Navcam and Pancam electronics would exceed 85OC when the bus voltage was at a maximum of 33 V.

The initial step taken to rectify the situation was a re- specification of heater sizing requirement: Meet the l-hr warm-up requirement with a 28 V bus. This would mitigate the higher heater power dissipation in the stuck- on 33 V situation. Using this approach, the rocker deployment actuator and the Navcam and Pancam electronics were no longer overheating. However, the PMA, HGAA, and IDD actuators still overheated. During this design resolution, the thermal hardware (heaters and temperature sensors) was being integrated with the actuator hardware. JPL supplied end users with the actuators so sufficient lead-time was required to enable end users to deliver their hardware on schedule. Clearly, any design resolution for the remaining actuators would reside at the system-level since schedule was critical.

Figure 7: BlMU thermal development test article

Figure 8: Rover heater thermostat assembly

temperature of 3OoC was selected for assessment. Thermal analysis using this set-point demonstrated that the Pancam and HGAA actuators would be protected from overheating in a heater stuck-on fault condition. However, the IDD actuators had a small 2-hour window from 500 to 7:OO LST where the actuators still would overheat since the thermostat had not cut-off the warm- up heater. In order to prevent the IDD actuators from overheating, an open and close set-point of -7OOC would be required. This would preclude early morning operation of the IDD since the IDD warm-up would be cut-off before sufficient thermal conditioning. The optimal balance between technical and programmatic risk pointed toward the use of thermostats with a 3OoC set- point.

The availability of space-qualified thermostats posed a formidable challenge for this implementation. High- reliability space-qualified thermostats typically required 3 to 6 months lead time for a new build. A more expedient approach would be to canvas thermostat vendors for their residual stock. This approach proved successful when 30 previously flight-qualified thermostats were located with a set-point of -4OOC and procured in about 2 months. The lower set-point than the specified 3OoC was acceptable since it did not significant change the cut-off or return to operation times. As a footnote, only 4 thermostats with -7OOC setpoint were located and at least 8 thermostats were required for the MER flight build.

A total of 5 warm-up heaters circuits throughout the PMA, HGAA, and IDD were cabled through the Rover heater thermostat assembly that housed all 5 thermostats. The chassis of the Rover heater thermostat assembly was fabricated from carbon-fiber composite so there was no thermal expansion mismatch with its mounting location on the Rover WEB (also made from a carbon fiber composite). The exterior of the chassis was coated with space-qualified white paint to reduce the impact of solar flux impingement during the early morning; the Rover solar array provided Sun shading most of the daytime. The interior of the assembly was coated with vapor-deposited aluminum to radiatively isolate the assembly from the WEB. The thermostats were mounted to the top of the assembly to minimize their conductive path to the WEB. The hardware is shown in Figure 8 and the mounting location on the Rover is shown in Figure 9.

When MER-B (Opportunity) landed on Mars on January 25, 2004, an anomalous nighttime current draw was detected. A stuck-on IDD warm-up heater was initially suspected. Unfortunately, there were only flight temperature sensors on 2 of the 5 IDD actuators, and the suspected actuator with the stuck-on heater had a flight temperature sensor that failed during the Rover thermal balance testing. Because of the high risk for an in-situ repair, the Project opted to forego replacement of this temperature sensor. However, inferred diagnosis of flight power and temperature telemetry strongly verified that one of the IDD heater circuits was stuck-on. One unmistakable piece of evidence that led to this conclusion was the timing of this anomalous load. The load would be shed around 1O:OO LST and then return about 12 hours later. Using flight temperature telemetry from other external Rover elements led to an approximation for the atmospheric temperature and the times that the anomalous current was shed and re- established corresponded very closely with the thermostat set-points of that IDD heater circuit. The Rover heater thermostat assembly was performing as designed and protected the IDD actuators from overheating. Another important attribute was the nighttime energy savings. Without the Rover heater thermostat assembly, approximately 180 W-hr would have been consumed from the Rover battery. This could have jeopardized the ability to carry out the 90 Martian day primary mission. Although a fault scenario was permitted to drive the thermal hardware implementation, the protective measures proved invaluable.

CONCLUSION

Despite the most proactive planning and preparation, thermal design challenges arise throughout the entire design and implementation life cycle. Programmatic factors such as budget and schedule tend to further complicate the situation. The resolution of these challenges requires a systems engineering perspective since thermal design usually crosses over several subsystem boundaries.

Figure 9: Installed Rover heater thermostat assembly

ACKNOWLEDGMENTS

The research described in this paper was carried out at the Jet Propulsion Laboratory, California Institute of Technology, under a contract with the National Aeronautics and Space Administration. Eug-Yun Kwack and Gary Kinsella assisted with the cold fill valve issue. Allan Eisenman served as the DSS hardware cognizant engineer and provided invaluable advice. Mark Duran and Pamela Hoffman implemented the CEM thermal hardware modification for the cold fill valve and DSS resolutions. George Chen, Edward Konefat, Edward Litty, and Edward Swenka of the MER Attitude Control Team assisted with the resolution of the BlMU thermal design. Jacqueline Lyra provided thermal system engineering support for the BlMU issue. Anthony Paris assisted with the BlMU thermal development test planning, preparation, and execution. Rick Welch, the MER chief systems engineer, spearheaded the effort to address the Rover warm-up heater issue. Chern-Jiin Lee and Siu-Chun Lee, both from Applied Science Laboratory, provided warm-up heater thermal analysis support. Gerald Gaugen and Stanley Winstein oversaw the design, fabrication, and assembly of the Rover heater thermostat assembly. Walter Walker and Gus Forsberg provided thermal coating support for the Rover heater thermostat assembly. Richard Cook and Barry Goldstein were the MER flight system manager and deputy manager, respectively, and were involved with all the decisions regarding the issues presented herein.

This paper is dedicated to my wife, Tammy Akahoshi and my father, Shigeru Tsuyuki. My wife endured many a day during the MER development raising our daughter, Kimberly without me, and my father passed away quietly on November 28, 2004 after a 14-month battle with cancer.

REFERENCES

1.

2.

3.

Roncoli, R. and Ludwinski, J., “Mission Design Overview for the Mars Exploration Rover Mission,” presented at AIAA/AAS Astrodynamics Specialist Conference, August 5-8, 2002, Monterey, California. Ganapathi, G., Birur, G., Tsuyuki, G., McGrath, P., and Patzold, J. “Active Heat Rejection System on Mars Exploration Rover - Design Changes from Mars Pathfinder,” Proceedings of the Space Technology and Applications International Forum, 2003. Institute of Space and Nuclear Studies, Albuquerque, NM. February 2003. Ganapathi, G., Birur, Tsuyuki, G., and Krylo, R. “Mars Exploration Rover Heat Rejection System Performance Comparison of Ground and Flight Data,” Proceedings of the International Conference on Environmental Systems, Paper 2004-01 -241 3, Colorado Springs, CO, July 2004.

4.

5.

Novak, K. “The Mars Pathfinder Propulsion Line Thermal Design: Testing, Analysis and Prelaunch Modifications,” Proceedings of the 9th Spacecraft Thermal Control Technology Workshop, El Segundo, CA, March 1998. Sunada, E, “Paraffin Actuated Heat Switch: Flight Implementation and Performance on the Mars Exploration Rovers,” Proceedings of the Space Technology and Applications International Forum, 2004. Institute of Space and Nuclear Studies, Albuquerque, NM. February 2004.

DEFINITIONS, ACRONYMS, ABBREVIATIONS

ARA: Airbag Retraction Actuator BIMU: Backshell Inertial Measurement Unit BIP: Backshell Interface Plate BPSA: Backshell Pyro CSL: Cruise Shunt Limiter CCD: Charged Couple Device CSS: Cruise Sun Sensor DIMES: Descent Image Motion Estimation System DRL: Descent Rate Limiter DSS: Digital Sun Sensor EDL: Entry, Descent, & Landing HGAA: High Gain Antenna Assembly HRS: Heat Rejection System IDD: Instrument Deployment Device IPA Integrated Pump Assembly KSC: Kennedy Space Center LEM: Lander Electronics Module LGA: Low Gain Antenna LPA Lander Petal Actuator LST: Local Solar Time MER: Mars Exploration Rover MPF: Mars Pathfinder MTES: Miniature Thermal Emission Spectrometer NASA: National Aeronautics and Space Administration PMA: Pancam Mast Assembly PRT: Platinum Resistance Thermometer RAD: Rocket Assisted Deceleration REU: Remote Engineering Unit REM: Rover Electronics Module RHU: Radioisotope Heater Unit RLM: Rover Lift Mechanism SDST: Small Deep Space Transponder SSPA: Solid-state Power Amplifier Sol: A Martian day, about 24 hours and 40 minutes TCA. Thruster Cluster Assembly TIRS: Transverse Impulse Rocket System UHF: Ultra High Frequency w: Volts W-hr: Watt-hour, a measure of energy usage WEB: Warm Electronics Box